CVE-2026-2743

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Arbitrary File Write via Path Traversal upload to Remote Code Execution in SeppMail User Web Interface. The affected feature is the large file transfer (LFT).

This issue affects SeppMail: 15.0.2.1 and before

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-434

Affected software

Vendor	Product	Versions
SeppMail	SeppMail	>= unknown, <= 15.0.2.1

References

Timeline

Published: Mar 5, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-274307.1Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.CVE-2026-274325.4Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Acce CVE-2026-274336.5Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.CVE-2026-274345.3Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Securi CVE-2026-274355.3Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels. This issu CVE-2026-274369.1Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.CVE-2026-274379.8Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis C CVE-2026-274389.8Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a thr CVE-2026-274399.8Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a CVE-2026-274406.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored CVE-2026-274419.8SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution.CVE-2026-274427.5The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted